☰

将流量转发到单独命名空间中的虚拟以太网适配器时出现“网络不可达”

tag-icon • tag-icon linux networking
将流量转发到单独命名空间中的虚拟以太网适配器时出现“网络不可达”

我的目标是在我的 Linux 服务器上设置一个单独的命名空间，用于 OpenVPN 连接，然后用于 VirtualBox 主机。

到目前为止我已经遵循了以下步骤：

  1. 设置cronjob@reboot /home/ubuntu/startupscripts/rootscripts.sh
  2. 在 shell 脚本中执行：（改编自此处） # Setup VPN ip netns add vpnspace ip link add vpnopen type veth peer name vpnbind ip link set vpnopen netns vpnspace ip netns exec vpnspace /sbin/ifconfig vpnopen 10.0.0.1/24 up （见问题） /sbin/ifconfig vpnbind up**
  3. 添加了下面的 iptables 规则并重新配置了 iptables-persistent（改编自） （见问题） -A FORWARD -i vpnbind -o ens3 -j ACCEPT -A FORWARD -i ens3 -o vpnbind -m state --state ESTABLISHED,RELATED -j ACCEPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE

**我添加了这一步骤，因为sudo lshw -C network显示网络连接未处于活动状态。（见问题）

当我尝试sudo ip netns exec vpnspace ping 8.8.8.8从终端时，我收到错误消息connect: Network is unreachable。我不知道接下来该怎么做。

以下是各种输出。如果您希望我添加其他输出，请在评论中告诉我们。

是否配置：

ens3      Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          inet addr:XXX.XXX.XXX.92  Bcast:XXX.225.222.255  Mask:255.255.255.0
          inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:44943 errors:16 dropped:0 overruns:0 frame:16
          TX packets:467 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:3042544 (3.0 MB)  TX bytes:49351 (49.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1 
          RX bytes:100 (100.0 B)  TX bytes:100 (100.0 B)

vpnbind   Link encap:Ethernet  HWaddr XX:XX:XX:XX:XX:XX  
          inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:8 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:648 (648.0 B)  TX bytes:0 (0.0 B)

sudo ip netns exec vpnspace ifconfig：

vpnopen   Link encap:Ethernet  HWaddr 36:28:6f:74:1b:72  
          inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
          inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:0 (0.0 B)  TX bytes:648 (648.0 B)

ip 链接显示：

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
3: vpnbind@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff link-netnsid 0

sudo ip netns exec vpnspace ip link show：

1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: vpnopen@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff link-netnsid 0

/etc/网络/接口：

# The loopback network interface
auto lo
iface lo inet loopback

# Preconfigured by my VPS provider
auto ens3
iface ens3 inet static
        address XXX.XXX.XXX.92
        netmask 255.255.255.0
        broadcast +
        up route -A inet add XXX.XXX.XXX.1 dev ens3
        up route -A inet add default gw XXX.XXX.XXX.1 dev ens3
iface ens3 inet6 manual
        pre-down ip -6 addr flush dev ens3 scope global || :

更新脚本

ip netns add vpnspace
ip link add vpnopen type veth peer name vpnbind

echo 1 > /proc/sys/net/ipv4/conf/ens3/forwarding
echo 1 > /proc/sys/net/ipv4/conf/vpnbind/forwarding

ip link set vpnbind up

ip link set vpnopen netns vpnspace
ip -n vpnspace addr add 10.0.0.1 dev vpnopen
ip -n vpnspace addr add 10.0.0.254 broadcast 10.0.0.255 dev vpnopen
ip -n vpnspace link set vpnopen up
ip -n vpnspace route add default via 10.0.0.254

答案1

您有指向其自身的默认路由vpnspace。您应该将地址添加10.0.0.254到vpnbind而不是vpnopen。

另外，您已将 10.0.0.0/8 全部分配给您的 veth 对，这将导致无法访问该地址范围内的其他主机。

相关内容